Keywords

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

1 Introduction

Admittedly, in Europe there is no party as in George Orwell’s “1984” that is capable of reshaping the past. However, it must be examined to what extent “forgetting” and “being forgotten” are able to influence the legal system and society.

Already in 2010, the former European Commissioner for Justice Viviane Reding demanded that every EU-citizen should have a right to be forgotten.Footnote 1

Six years later it is still questionable whether a codified right to be forgotten exists (2. and 3.) or will exist (4.), how one can reconcile the different interests of all parties (5.) and how such a right can be enforced (6.).

2 The Current Legal Situation in Germany

The purpose of the right to be forgotten is the protection of privacy. The aspects regarding data protection law are regulated in the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG). The more the lives of individuals can be monitored online, the more relevant becomes the questions of deleting lawfully saved data from the internet.Footnote 2

Regarding the claims of the data subject against non-public bodies, section 35 BDSG provides a right to correction, deletion and blocking and the contradiction against the elicitation, processing and use of their data. This way it is possible to prohibit and restrict the unlawful (and under certain circumstances even lawful) processing of personal data.Footnote 3

As far as social networks are concerned, one can refer to section 35 para. 2 sentence 2 no. 4 BDSG, which regulates that data shall be erased if an examination shows that further storage is unnecessary. This is the case when the data subject demands erasure from the respective service provider.Footnote 4 As far as the data subject contradicts at the responsible body and his or her interest outweighs, it is prohibited to use personal data and to gather it for an automatic processing. That might at least be the case if the data subject wants to erase his or her personal data that was uploaded in a social network by a third party.Footnote 5

3 Standards of the ECJ

A judgment of the ECJ from 2014 made a man famous who actually had the intense desire to achieve the exact opposite.

The Spaniard Mario Costeja Gonzalez had not paid his social insurance contributions. Therefore his house was about to be put up for compulsory sale. Eleven years later, he discovered that, whenever he googled his name, the reporting about this incident was one of the first search results. His attempts to make Google Spain delete the corresponding links remained unsuccessful.

The ECJ held that the practice of searching engines was a use of personal data and that these companies are obligated to delete the links to websites of third parties under certain circumstances. Furthermore, it is not important, whether the publication of the personal data on the website of the third party was lawful or not.

However according to the German jurisdiction, in case of a lawful publication the right to information outweighs the right to be forgotten.Footnote 6 As a reason to give priority to the right to be forgotten, the ECJ named the risk of a detailed profile building. This danger would be increased by the importance of searching engines in the modern society.Footnote 7

On the one hand, the jurisdiction of the ECJ was strongly criticized,Footnote 8 on the other hand it was called one of the most important jurisdictions of the ECJ of all time.Footnote 9

The main opinion of the daily press that this jurisdiction of the ECJ constitutes the first proper right to be forgotten, is not convincing. The ECJ does not demand to delete the information itself from the internet. The operators of searching engines are only forced to delete the link to the information. The terms “the right to be hidden”Footnote 10 and “the right not to be indexed”Footnote 11 are more precise.

Further, it can be criticized that without any explanatory statement the ECJ refused to applicate the privilege of the media regarding data protection, which is based on the freedom of press, to the operators of searching engines.Footnote 12

So far, according to Google’s interpretation of the judgment the links only had to be deleted from the European Google-domains. The relevant information was still available via google.com. After heavy criticism by privacy protection stakeholders, Google now uses geo location signals to establish a global access restriction. However, this tool only prevents the access to the URL by computers located in the country of the person, who requested the blocking.Footnote 13

4 The General Data Protection Regulation

The GDPRFootnote 14 will take effect in 2018 and explicitly codifies the right to be forgotten for the first time.

Despite all media-effective announcements, article 17 turns out to be nothing more than a right of the affected person to request erasure of personal data concerning him or her from the respective responsible person. The legal norm lacks an automatic deletion of information after a certain time, which is suggested by the passive formulation “to be forgotten”. Article 17 para. 2 GDPR determines that a person, who published the data and is obliged to delete it, has to take all reasonable actions to inform third parties that also processed data like copies and hyperlinks must be deleted. These claims are rather a “right to erasure”. It must be used actively. Nevertheless, the aim is similar and it is based on the same idea of protection.

The key question in this context is the relationship between the entitlement to deletion and the public interest in information.

For this purpose, Article 17 para. 3 lit. a GDPR states that the claim shall not apply to the extent that the processing is necessary for exercising the right of freedom of expression and information. Additionally, Article 85 para 1, 2 GDPR gives the member states the extensive permission to harmonize the right to protection of personal data and the protection of the freedom of expression and information by establishing national regulations. They can define exemptions, in particular for journalistic purposes.

By handing such an important decision to the member states, the unique opportunity to form similar regulations throughout the Union and to determine an order of priority between the different legal interests, was missed.

5 The Complex Tangle of Interests

Depending on the individual case, the vital interest of the affected person to protect his or her personal rights conflicts with the business interest of internet companies, the authors’ freedom of expression and the public’s freedom of information.Footnote 15

To bring these different rights in accordance, various criteria can be gathered from the judgment of the ECJ. These criteria are not isolated, but interact with each other. Four general categories can be built:

Firstly, the role of the affected person in public life must be considered.Footnote 16 The smaller this role, the bigger is the entitlement for privacy.Footnote 17 To classify persons with either permanent or no importance for public life, e.g. politicians or “normal” citizens is not a problematic subject. It is more challenging though to categorize people with a contextual public presence, such as participants of casting shows.

The type of the information serves as a second criterion. It has to be taken in consideration that information can be both sensible for the affected person and of relevance for the public.Footnote 18 For this purpose, the “theory of spheres” can be used.Footnote 19 After this theory, there are three different spheres, the social-sphere, the private-sphere and the intimate-sphere. In general, interference in the intimate-sphere indicates a right for deletion. An interference in the social-sphere indicates the opposite. The validity of the information is also relevant.Footnote 20

Thirdly, the source of the information should be analyzed. The more dubious the source is, the more reasons to speak in favor of a deletion.Footnote 21

The fourth criterion is time. Up-to-date information has a higher need for protection than older information.Footnote 22

6 Enforcement of the Claim

Not only the tangle of interests, but also the enforcement of the claim poses various difficulties. In order to prevent negative side effects, like the Streisand effect,Footnote 23 requests for deletion must be dealt with confidentially.

To create legal certainty the underlying procedure has to be formalized. The legislator should establish a harmonized format for applications based on the model of the cancellation policy.

In case of failure to reach an agreement, there is still the opportunity to go to ordinary courts. In Germany alone, there have been nearly 100.000 requests so far to Google for deletion since the ECJ judgment. Since more than half of the requests were refusedFootnote 24 this could mean a significant additional burden to the courts.

One way to prevent an overload is to establish an intermediary body in the form of German or European arbitration bodies.Footnote 25 Only in case of failure to reach an agreement at this intermediary instance the track to the ordinary courts would be open.

However, the question remains under which conditions third parties that have processed information can be obliged to erase the information in internet related cases.Footnote 26 A complete erasure often collides with the fast and elusive distribution of information in the Internet.Footnote 27

7 Conclusion

It is the mutual task of politics, justice and society to reconcile the conflicting interests of personality and information. To prevent the individual from being forced to make use of his or her right to be forgotten, information and sensitization relating the infringement of fundamental rights through carefree handling of personal data should be promoted.Footnote 28 To avoid the cumbersome procedure of a deletion, one should only make as much personal data available in the internet as necessary.